2

I came across several cases where people are validating the saml response (verifying the signatures in the xml using the IdP's public key). But, Why do we need to do that? (unless http is being used)

This might be a dumb question, but google is not much of a friend in this case and couldn't find much in saml specs.

Thank you

Nagarjuna Borra
  • 141
  • 3

1 Answers1

2

Here is the SAML flow

  1. The user accesses the remote application using a link on an intranet, a bookmark, or similar and the application loads.

  2. The application identifies the user’s origin (by application subdomain, user IP address, or similar) and redirects the user back to the identity provider, asking for authentication. This is the authentication request.

  3. The user either has an existing active browser session with the identity provider or establishes one by logging into the identity provider.

  4. The identity provider builds the authentication response in the form of an XML-document containing the user’s username or email address, signs it using an X.509 certificate, and posts this information to the service provider.

  5. The service provider, which already knows the identity provider and has a certificate fingerprint, retrieves the authentication response and validates it using the certificate fingerprint.

  6. The identity of the user is established and the user is provided with app access.

So its point 5 which you are questioning? Here the Identity provider is Pushing the token to the Service provider.

So in theory, I could fake up a athentication response and post it directly to the Service Provider. Even if in your particular flow the token is requested directly from the identity provider, I could still potentially intercept that request and substitute my own reply.

What stops me (amongst other things) is that the message has to be signed by the Identity provider and the Service provider has the key required to validate that signature.

Ewan
  • 70,664
  • 5
  • 76
  • 161
  • no prob, these auth flows can be confusing – Ewan Apr 05 '19 at 09:03
  • Ah! It did turn out to be a dumb question!. I forgot the fact that the process involves redirects(somehow, my brain managed to interpret it as a synchronous http request and response) and anyone could send a samlresponse and gain access, so sp should obviously check if it came from the IdP or not. Sorry, I should have give it some thought instead of rushing in and posting a question. – Nagarjuna Borra Apr 05 '19 at 09:12
  • What exactly happens when the Service provider has the public key of the IDP in the SAMLresponse and validates the signature. What is inside the signature and what is the meaning of validation? – ebeb Sep 27 '22 at 21:01
  • is a cryptographic public/private key pair. the message is signed with the private key and that signature can be checked with the public to prove the message is from the auth provider rather than faked – Ewan Sep 28 '22 at 16:46